CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Affected products
synacor: zimbra collaboration suite
References7
- wiki.zimbra.com/wiki/Security_Center PatchVendor Advisory
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- wiki.zimbra.com/wiki/Security_Center PatchVendor Advisory
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.… ExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 92% percentile: 100 · as of 2 November 2026
- CWE
- CWE-22